chore(deps): Bump the production group across 1 directory with 23 updates by dependabot[bot] · Pull Request #207 · LAF-labs/openbot

dependabot · 2026-10-11T21:16:31Z

Bumps the production group with 23 updates in the / directory:

Package	From	To
yaml	`2.9.0`	`2.9.1`
@base-ui/react	`1.7.0`	`1.8.0`
@copilotkit/react-core	`1.67.1`	`1.77.0`
@shadcn/react	`0.3.0`	`0.3.1`
@tabler/icons-react	`3.46.0`	`3.48.0`
@tanstack/react-query	`5.101.4`	`5.104.1`
@tanstack/react-router	`1.170.27`	`1.170.41`
better-auth	`1.6.27`	`1.7.7`
prompt-area	`0.6.3`	`0.7.1`
react	`19.2.8`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
remark-cjk-friendly	`2.3.1`	`2.3.2`
shadcn	`4.17.0`	`4.21.1`
streamdown	`2.5.0`	`2.7.0`
tailwind-merge	`3.6.0`	`3.7.0`
zod	`4.4.3`	`4.6.6`
@better-auth/drizzle-adapter	`1.6.27`	`1.7.7`
@copilotkit/runtime	`1.67.1`	`1.77.0`
@modelcontextprotocol/sdk	`1.30.0`	`1.32.0`
drizzle-kit	`0.31.10`	`0.31.11`
drizzle-orm	`0.45.2`	`0.45.3`
hono	`4.13.7`	`4.13.13`
playwright	`1.62.1`	`1.63.0`

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

Limit recursive merge aliases (#685, #713)

Simplify line unfolding during quoted string parsing (#714)

Commits

1440ecd 2.9.1
c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
d11ce77 fix: Limit recursive merge aliases (#713)
c5f49f4 chore: Update docs-slate
See full diff in compare view

Updates @base-ui/react from 1.7.0 to 1.8.0

Release notes

Sourced from @base-ui/react's releases.

v1.8.0

General changes

Fix label association when a control unregisters (#5456) by @atomiks

Reduce animation completion work (#5535) by @atomiks

Fix prop and ref merging for lazy render elements (#5562) by @atomiks

Fix roving focus when items are added or removed (#5447) by @atomiks

Fix hover and focus interaction issues (#5037) by @atomiks

Improve trigger mount performance (#5426) by @atomiks

Fix disabled anchor tracking on scroll (#5478) by @atomiks

Fix transform origin for start/end alignment (#5015) by @atomiks

Remove duplicate options key from arrow middleware (#5606) by @atomiks

Register passive touch listeners (#5572) by @wanxiankai

Alert Dialog

Ignore outside clicks from presses that began before open (#5378) by @michaldudak

Autocomplete

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

Move aria-orientation to the role owners (#5551) by @gonzoblasco

Hide group labels and scrollbars from the accessibility tree (#5598) by @azeng4499

Avatar

Add keepMounted prop to <Avatar.Image> (#5536) by @atomiks

Checkbox

Fix stale and duplicated control IDs (#5457) by @atomiks

Fix controlled blur validation and stale filled state (#5563) by @atomiks

Checkbox Group

Fix stale and duplicated control IDs (#5457) by @atomiks

Combobox

Fix applying data-readonly to <Combobox.Trigger> (#5418) by @sai6855

Add createItems collection API (#5326) by @atomiks

Fix cancellation when preserving the filter after selection (#5362) by @atomiks

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

Move aria-orientation to the role owners (#5551) by @gonzoblasco

Fix record item label lookup reading from Object.prototype (#5518) by @XionWCFM

Anchor multiple selection to the first selected item with a linear lookup (#5573, #5613) by @atomiks and @michaldudak

Hide group labels and scrollbars from the accessibility tree (#5598) by @azeng4499

... (truncated)

Changelog

Sourced from @base-ui/react's changelog.

v1.8.0

Sep 4, 2026

General changes

Fix label association when a control unregisters (#5456) by @atomiks

Reduce animation completion work (#5535) by @atomiks

Fix prop and ref merging for lazy render elements (#5562) by @atomiks

Fix roving focus when items are added or removed (#5447) by @atomiks

Fix hover and focus interaction issues (#5037) by @atomiks

Improve trigger mount performance (#5426) by @atomiks

Fix disabled anchor tracking on scroll (#5478) by @atomiks

Fix transform origin for start/end alignment (#5015) by @atomiks

Remove duplicate options key from arrow middleware (#5606) by @atomiks

Register passive touch listeners (#5572) by @wanxiankai

Alert Dialog

Ignore outside clicks from presses that began before open (#5378) by @michaldudak

Autocomplete

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

Move aria-orientation to the role owners (#5551) by @gonzoblasco

Hide group labels and scrollbars from the accessibility tree (#5598) by @azeng4499

Avatar

Add keepMounted prop to <Avatar.Image> (#5536) by @atomiks

Checkbox

Fix stale and duplicated control IDs (#5457) by @atomiks

Fix controlled blur validation and stale filled state (#5563) by @atomiks

Checkbox Group

Fix stale and duplicated control IDs (#5457) by @atomiks

Combobox

Fix applying data-readonly to <Combobox.Trigger> (#5418) by @sai6855

Add createItems collection API (#5326) by @atomiks

Fix cancellation when preserving the filter after selection (#5362) by @atomiks

Render groups with the rowgroup role in grid mode (#5564) by @atomiks

Allow opening and browsing the popup while readOnly (#5541) by @vikuscz

... (truncated)

Commits

47b4052 [release] v1.8.0 (#5609)
dd13809 [toast] Accept an updater function in the update method instead of on data (#...
670e95c [docs] Update docs infra to restore generated types (#5616)
e8526f7 [utils] Restore frozen EMPTY_ARRAY (#5620)
b7f6683 [number field] Preserve consumer selection when focusing the input (#5619)
b8c5d78 [context menu] Correct generated API metadata (#5523)
261d699 [combobox][autocomplete] Document that items must not contain nullish entries...
0a6ff44 [toast] Replace custom data wholesale and accept a function to derive it (#5611)
2e1bddd [combobox][select] Make the multiple selection anchor lookup linear (#5613)
ad83c8a [code-infra] Run TypeScript 7 alongside the TS6 JS API (#5603)
Additional commits viewable in compare view

Updates @copilotkit/react-core from 1.67.1 to 1.77.0

Release notes

Sourced from @copilotkit/react-core's releases.

v1.77.0

Features

feat(react-core): make intelligence indicator auto-mount configurable (#6612) (a161b38)

feat(learning): capture raw browser activity as AG-UI events (#7556) (1840e7c)

feat(mcp-apps): consolidate the Vue and Angular hosts onto the shared package (#7161) (06f61ae)

feat(web-inspector): add an option to hide the Inspector indefinitely (#7542) (20ee84c)

Fixes

fix(deps): bump @ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run (#7600) (f1a9bb6)

fix(a2ui): keep generated controls from submitting host forms (#7392) (214614a)

fix(react, vue): preserve popup rounded corners (#6473) (0629f84)

fix(a2ui-renderer): contain malformed component values (#7583) (a9b1c26)

fix(core): pass ContentPart[] tool handler results through to the tool message (#7544) (579d0f7)

fix(web-inspector): send onboarding_run_id on the Learning setup prompt click (#7561) (c69b965)

fix: preserve LangGraph catalogs with merged AG-UI properties (#7558) (9c6f1dd)

Other Changes

Improve Inspector conversation readability and tool-call presentation (#7374) (632b050)

docs(runtime): document the agentId the Intelligence threads list requires (refs PE-476) (#7562) (16dbbdf)

v1.76.0

Features

feat: AG-UI 1.0 for CopilotKit (#7270) (7693a04)

Fixes

fix(runtime): stop reusing per-response provider ids as message ids (#7522) (5832fff)

fix(web-inspector): fit and scale the Inspector on small screens (#7529) (5135c56)

fix(runtime): prefix MCP tools whose names collide instead of dropping them (#7495) (c7c4538)

v1.75.2

Fixes

fix(react-core): use new run IDs for standard interrupt resumes (#7001) (081e745)

fix(vue): stop cloning run state six times per row for message slots (#7525) (bd39b04)

v1.75.1

Features

feat(angular)!: render A2UI without Lit and support web component cat… (#7504) (b3d1aad)

Fixes

fix(core): distinguish Intelligence replay errors from live failures (#7353) (278a78d)

fix(mcp-apps-renderer): follow the host page's dark theme (#7467) (2476de1)

fix(runtime): forward imported backend thread identity (#7489) (5fd09ab)

... (truncated)

Changelog

Sourced from @copilotkit/react-core's changelog.

1.77.0 - 2026-10-02

Features

feat(react-core): make intelligence indicator auto-mount configurable (#6612) (a161b38)

feat(learning): capture raw browser activity as AG-UI events (#7556) (1840e7c)

feat(mcp-apps): consolidate the Vue and Angular hosts onto the shared package (#7161) (06f61ae)

feat(web-inspector): add an option to hide the Inspector indefinitely (#7542) (20ee84c)

Fixes

fix(deps): bump @ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run (#7600) (f1a9bb6)

fix(a2ui): keep generated controls from submitting host forms (#7392) (214614a)

fix(react, vue): preserve popup rounded corners (#6473) (0629f84)

fix(a2ui-renderer): contain malformed component values (#7583) (a9b1c26)

fix(core): pass ContentPart[] tool handler results through to the tool message (#7544) (579d0f7)

fix(web-inspector): send onboarding_run_id on the Learning setup prompt click (#7561) (c69b965)

fix: preserve LangGraph catalogs with merged AG-UI properties (#7558) (9c6f1dd)

Other Changes

Improve Inspector conversation readability and tool-call presentation (#7374) (632b050)

docs(runtime): document the agentId the Intelligence threads list requires (refs PE-476) (#7562) (16dbbdf)

1.76.0 - 2026-09-30

Features

feat: AG-UI 1.0 for CopilotKit (#7270) (7693a04)

Fixes

fix(runtime): stop reusing per-response provider ids as message ids (#7522) (5832fff)

fix(web-inspector): fit and scale the Inspector on small screens (#7529) (5135c56)

fix(runtime): prefix MCP tools whose names collide instead of dropping them (#7495) (c7c4538)

1.75.2 - 2026-09-30

Fixes

fix(react-core): use new run IDs for standard interrupt resumes (#7001) (081e745)

fix(vue): stop cloning run state six times per row for message slots (#7525) (bd39b04)

1.75.1 - 2026-09-29

Features

feat(angular)!: render A2UI without Lit and support web component cat… (#7504) (b3d1aad)

Fixes

... (truncated)

Commits

e745116 chore: release monorepo v1.77.0 (#7602)
95f0247 chore: release monorepo v1.77.0
f1a9bb6 fix(deps): bump @ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph ru...
faac16d fix(deps): bump @ag-ui/langgraph to 0.0.44 so a stop cancels the LangGraph run
25e7e86 feat(release): publish Learning and monorepo previews together (#7597)
3622ab1 Merge branch 'main' into codex/learning-preview-canary
c88a2dd ci(showcase): build no image for a package-only PR, all images for a workflow...
edaf067 ci(showcase): build no image for a package-only PR, all images for a workflow...
cfb9486 feat(release): publish Learning and monorepo previews together
a161b38 feat(react-core): make intelligence indicator auto-mount configurable (#6612)
Additional commits viewable in compare view

Updates @shadcn/react from 0.3.0 to 0.3.1

Release notes

Sourced from @shadcn/react's releases.

@shadcn/react@0.3.1

Patch Changes

#11720 503a3a57aec9a3817e37f90aa0817b1fabd284d0 Thanks @shadcn! - Set data-pending-scroll on the MessageScroller root and viewport until defaultScrollPosition ("end" or "last-anchor") is applied, so the viewport can be hidden and a server-rendered transcript does not flash the top of the thread on reload.

Changelog

Sourced from @shadcn/react's changelog.

0.3.1

Patch Changes

#11720 503a3a57aec9a3817e37f90aa0817b1fabd284d0 Thanks @shadcn! - Set data-pending-scroll on the MessageScroller root and viewport until defaultScrollPosition ("end" or "last-anchor") is applied, so the viewport can be hidden and a server-rendered transcript does not flash the top of the thread on reload.

Commits

63c1308 chore(release): version packages (#11714)
503a3a5 fix(react): hide MessageScroller until the opening position applies (#11720)
See full diff in compare view

Updates @tabler/icons-react from 3.46.0 to 3.48.0

Release notes

Sourced from @tabler/icons-react's releases.

Release 3.48.0

18 new icons:

outline/duplicate

outline/folder-ai

outline/folder-sparkle

outline/git-branch-check

outline/git-branch-x

outline/git-merge-queue

outline/git-pull-request-locked

outline/git-pull-request-unlisted

outline/message-2-ai

outline/message-2-sparkle

outline/message-ai

outline/message-sparkle

outline/model-ai

outline/pencil-ai

outline/stack-check

outline/stack-minus

outline/stack-plus

outline/stack-x

Release 3.47.0

18 new icons:

outline/airpods-l

outline/airpods-r

outline/cash-coin

outline/edit-bulk

outline/folder-stats

outline/folder-user

outline/gpu-2

outline/gpu

outline/map-pinned

outline/orbit-vertical

outline/orbit

outline/orbits

outline/reduce-motion

outline/reference-image

outline/secret-phrases

outline/sticker-smile

outline/voice-2

outline/voice

Fixed icon: outline/align-right-2

... (truncated)

Commits

0239805 Release 3.48.0
87e7c39 Release 3.47.0
bbb9bdb Run tests in CI, fix ReactSVG type rot, add type and RSC guards (#1579)
45a7ca8 Remove trailing space from the icon class attribute (#1582)
55f87a7 Refresh package READMEs: fix wrong props, broken links and inconsistent struc...
See full diff in compare view

Updates @tanstack/react-query from 5.101.4 to 5.104.1

Release notes

Sourced from @tanstack/react-query's releases.

@tanstack/react-query-devtools@5.104.1

Patch Changes

Updated dependencies [ec060b6]:

@tanstack/query-devtools@5.104.1

@tanstack/react-query@5.104.1

@tanstack/react-query-next-experimental@5.104.1

Patch Changes

Updated dependencies []:

@tanstack/react-query@5.104.1

@tanstack/react-query-persist-client@5.104.1

Patch Changes

Updated dependencies []:

@tanstack/query-persist-client-core@5.104.1

@tanstack/react-query@5.104.1

@tanstack/react-query@5.104.1

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.104.1

@tanstack/react-query-devtools@5.104.0

Minor Changes

#11650 5279b05 - Build projects with Vite 8

Patch Changes

Updated dependencies [5279b05]:

@tanstack/query-devtools@5.104.0

@tanstack/react-query@5.104.0

@tanstack/react-query-next-experimental@5.104.0

Minor Changes

#11650 5279b05 - Build projects with Vite 8

Patch Changes

Updated dependencies [5279b05]:

@tanstack/react-query@5.104.0

@tanstack/react-query-persist-client@5.104.0

Minor Changes

... (truncated)

Changelog

Sourced from @tanstack/react-query's changelog.

5.104.1

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.104.1

5.104.0

Minor Changes

#11650 5279b05 - Build projects with Vite 8

Patch Changes

Updated dependencies [5279b05]:

@tanstack/query-core@5.104.0

5.103.3

Patch Changes

#11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project

Updated dependencies []:

@tanstack/query-core@5.103.3

5.103.2

Patch Changes

Updated dependencies [8a28904]:

@tanstack/query-core@5.103.2

5.103.1

Patch Changes

Updated dependencies [8330b2f, 3212966]:

@tanstack/query-core@5.103.1

5.103.0

Patch Changes

Updated dependencies [e57f816, fdae2ce, a1119e5, cbf77bf]:

@tanstack/query-core@5.103.0

5.102.8

Patch Changes

... (truncated)

Commits

29859ae ci: Version Packages (#11806)
339e09f chore(*): manage 'react' eslint plugins with pnpm 'catalog' (#11781)
0a57279 test({react,preact,solid,angular}-query/mutationOptions): fix 'mutationOpt1' ...
c51bb62 chore(*): declare '@eslint-react/eslint-plugin' in the react packages and exa...
a914613 chore(*): declare 'eslint-plugin-react-hooks' in the react packages that use ...
d99c84b chore(*): update '@eslint-react/eslint-plugin' to v5 and apply its 'recommend...
fd96529 chore(*): update 'eslint-plugin-react-hooks' to v7 and use its stable 'recomm...
e878990 chore(*): manage 'react' packages with pnpm 'catalog' (#11712)
2e1ad64 chore(*): declare 'npm-run-all2' once in the root 'package.json' like other s...
c1de23a chore(*): manage 'typescript' with pnpm 'catalog' and declare it in each pack...
Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.27 to 1.170.41

Release notes

Sourced from @tanstack/react-router's releases.

@tanstack/react-router@1.170.41

Patch Changes

#8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

#8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

#8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

#8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

Updated dependencies [d521abd]:

@tanstack/router-core@1.171.34

@tanstack/react-router@1.170.40

Patch Changes

#8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

@tanstack/router-core@1.171.33

@tanstack/react-router@1.170.39

Patch Changes

#8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.

Changelog

Sourced from @tanstack/react-router's changelog.

1.170.41

Patch Changes

#8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

#8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

#8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

#8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

Updated dependencies [d521abd]:

@tanstack/router-core@1.171.34

1.170.40

Patch Changes

#8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

@tanstack/router-core@1.171.33

1.170.39

Patch Changes

#8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.

1.170.38

Patch Changes

Updated dependencies [cecae54, 0103578, ce10dcd, 84936cc, bbd2336]:

@tanstack/router-core@1.171.32

1.170.37

Patch Changes

#8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

#8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

#8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

... (truncated)

Commits

57e126e ci: Version Packages (#8531)
614bc27 chore(deps): update TanStack Store to 0.11.2 (#8568)
60b8ad1 perf(react-router): omit inactive route wrapper components (#8529)
863c8a7 perf(react-router): reuse link selector results (#8522)
ff66a03 perf(react-router): consolidate root match provider (CodSpeed experiment) (#8...
f0e751d ci: Version Packages (#8497)
763ac8b test(react-router): regression for #2072 router context invalidation (#8499)
f5ffd38 perf(router): skip unused link preload cleanup across adapters (#8436)
ddad69a ci: Version Packages (#8486)
73bfc15 perf(react-router): avoid redundant link hydration updates (#8435)
Additional commits viewable in compare view

Updates better-auth from 1.6.27 to 1.7.7

Release notes

Sourced from better-auth's releases.

v1.7.7

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

Fixed a critical Magic Link account-takeover vulnerability. (#11494)

Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting. (#11491)

Fixed OAuth Proxy accepting sign-in state as a provider profile. (#11494) Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.

Fixed CAPTCHA errors missing the JSON Content-Type header. (#11476)

Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization. (#11375)

Fixed rate-limit errors missing the JSON Content-Type header. (#11469)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs. (#8686)

Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page. (#11402)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

Fixed concurrent PostgreSQL requests exceeding database-backed rate limits. (#11331)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

Fixed consumeOne deleting a record after a concurrent write invalidates its original condition. (#11495)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@aryan1306, @bytaesu, @gitmotion, @gustavovalverde, @lennondotw

Full changelog: v1.7.6...v1.7.7

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.7

Patch Changes

#11476 4186e36 Thanks @bytaesu! - Return CAPTCHA errors with the correct JSON Content-Type header.

#11469 8620aa9 Thanks @aryan1306! - Return rate limit errors with a JSON Content-Type header.

#11491 55cb92e Thanks @bytaesu! - Respect social provider disableSignUp when signing in with an ID token.

#11375 69defbc Thanks @bytaesu! - Refresh the active organization after sign-in when a session hook selects the initial organization.

#11494 ac54bfd Thanks @gustavovalverde! - Isolate OAuth state cookies and each OAuth Proxy payload with purpose-specific encryption keys. The oAuthProxy options and supported configuration remain unchanged.

Upgrade all Better Auth nodes that handle the same cookie-backed OAuth or SAML relay-state flow together. Upgrade every OAuth Proxy participant, including production and preview or development deployments, in the same cutover. OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows started before the upgrade must be restarted. Mixed old and new participants cannot exchange existing state or proxy payloads, and there is no fallback to the previous shared key.

#11494 ac54bfd Thanks @gustavovalverde! - Magic Link verification now accepts only records issued for Magic Link. Magic Link re...
Description has been truncated

…ates Bumps the production group with 23 updates in the / directory: | Package | From | To | | --- | --- | --- | | [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` | | [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.7.0` | `1.8.0` | | [@copilotkit/react-core](https://github.com/CopilotKit/CopilotKit) | `1.67.1` | `1.77.0` | | [@shadcn/react](https://github.com/shadcn-ui/ui/tree/HEAD/packages/react) | `0.3.0` | `0.3.1` | | [@tabler/icons-react](https://github.com/tabler/tabler-icons/tree/HEAD/packages/icons-react) | `3.46.0` | `3.48.0` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.104.1` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.27` | `1.170.41` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.27` | `1.7.7` | | [prompt-area](https://github.com/just-marketing/prompt-area/tree/HEAD/packages/prompt-area) | `0.6.3` | `0.7.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [remark-cjk-friendly](https://github.com/tats-u/markdown-cjk-friendly) | `2.3.1` | `2.3.2` | | [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.17.0` | `4.21.1` | | [streamdown](https://github.com/vercel/streamdown/tree/HEAD/packages/streamdown) | `2.5.0` | `2.7.0` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.6` | | [@better-auth/drizzle-adapter](https://github.com/better-auth/better-auth/tree/HEAD/packages/drizzle-adapter) | `1.6.27` | `1.7.7` | | [@copilotkit/runtime](https://github.com/CopilotKit/CopilotKit) | `1.67.1` | `1.77.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.0` | | [drizzle-kit](https://github.com/drizzle-team/drizzle-orm) | `0.31.10` | `0.31.11` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` | | [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.13` | | [playwright](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` | Updates `yaml` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) Updates `@base-ui/react` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/mui/base-ui/releases) - [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md) - [Commits](https://github.com/mui/base-ui/commits/v1.8.0/packages/react) Updates `@copilotkit/react-core` from 1.67.1 to 1.77.0 - [Release notes](https://github.com/CopilotKit/CopilotKit/releases) - [Changelog](https://github.com/CopilotKit/CopilotKit/blob/main/CHANGELOG.md) - [Commits](CopilotKit/CopilotKit@v1.67.1...v1.77.0) Updates `@shadcn/react` from 0.3.0 to 0.3.1 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/@shadcn/react@0.3.1/packages/react) Updates `@tabler/icons-react` from 3.46.0 to 3.48.0 - [Release notes](https://github.com/tabler/tabler-icons/releases) - [Changelog](https://github.com/tabler/tabler-icons/blob/main/packages/icons-react/CHANGELOG.md) - [Commits](https://github.com/tabler/tabler-icons/commits/v3.48.0/packages/icons-react) Updates `@tanstack/react-query` from 5.101.4 to 5.104.1 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.1/packages/react-query) Updates `@tanstack/react-router` from 1.170.27 to 1.170.41 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.41/packages/react-router) Updates `better-auth` from 1.6.27 to 1.7.7 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.7/packages/better-auth) Updates `prompt-area` from 0.6.3 to 0.7.1 - [Release notes](https://github.com/just-marketing/prompt-area/releases) - [Changelog](https://github.com/just-marketing/prompt-area/blob/main/packages/prompt-area/CHANGELOG.md) - [Commits](https://github.com/just-marketing/prompt-area/commits/v0.7.1/packages/prompt-area) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `remark-cjk-friendly` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/tats-u/markdown-cjk-friendly/releases) - [Commits](https://github.com/tats-u/markdown-cjk-friendly/compare/remark-cjk-friendly@2.3.1...remark-cjk-friendly@2.3.2) Updates `shadcn` from 4.17.0 to 4.21.1 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.1/packages/shadcn) Updates `streamdown` from 2.5.0 to 2.7.0 - [Release notes](https://github.com/vercel/streamdown/releases) - [Changelog](https://github.com/vercel/streamdown/blob/main/packages/streamdown/CHANGELOG.md) - [Commits](https://github.com/vercel/streamdown/commits/streamdown@2.7.0/packages/streamdown) Updates `tailwind-merge` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge) Updates `zod` from 4.4.3 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.6) Updates `@better-auth/drizzle-adapter` from 1.6.27 to 1.7.7 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/drizzle-adapter/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.7/packages/drizzle-adapter) Updates `@copilotkit/runtime` from 1.67.1 to 1.77.0 - [Release notes](https://github.com/CopilotKit/CopilotKit/releases) - [Changelog](https://github.com/CopilotKit/CopilotKit/blob/main/CHANGELOG.md) - [Commits](CopilotKit/CopilotKit@v1.67.1...v1.77.0) Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.0) Updates `drizzle-kit` from 0.31.10 to 0.31.11 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.31.10...drizzle-kit@0.31.11) Updates `drizzle-orm` from 0.45.2 to 0.45.3 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3) Updates `hono` from 4.13.7 to 4.13.13 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.7...v4.13.13) Updates `playwright` from 1.62.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.1...v1.63.0) --- updated-dependencies: - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: "@base-ui/react" dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@copilotkit/react-core" dependency-version: 1.77.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@shadcn/react" dependency-version: 0.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: "@tabler/icons-react" dependency-version: 3.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@tanstack/react-query" dependency-version: 5.104.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@tanstack/react-router" dependency-version: 1.170.41 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: better-auth dependency-version: 1.7.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: prompt-area dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: remark-cjk-friendly dependency-version: 2.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: shadcn dependency-version: 4.21.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: streamdown dependency-version: 2.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: tailwind-merge dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@better-auth/drizzle-adapter" dependency-version: 1.7.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@copilotkit/runtime" dependency-version: 1.77.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: drizzle-kit dependency-version: 0.31.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: drizzle-orm dependency-version: 0.45.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: hono dependency-version: 4.13.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: playwright dependency-version: 1.63.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>

codesolarlght

🔆 CodeSolar review ✅ Looks good

Routine Dependabot dependency bump across 4 package.json files (app, server, agent-computer, root) with 23 package updates. All version changes are patch or minor bumps within the same major version. No source code changes.

✅ No issues worth flagging.

_{solar-pro4 (openrouter) · 4 files · +272/-286 · 53.9s · CodeSolar}

_{Comment /codesolar on this PR to re-run the review.}

…that have no surface of their own Tier 1, patch level: yaml 2.9.0 → 2.9.1, @shadcn/react 0.3.0 → 0.3.1, remark-cjk-friendly 2.3.1 → 2.3.2, drizzle-kit 0.31.10 → 0.31.11, drizzle-orm 0.45.2 → 0.45.3, hono 4.13.7 → 4.13.13, @tanstack/react-router 1.170.27 → 1.170.41, @tanstack/router-plugin 1.168.30 → 1.168.42, @biomejs/biome 2.5.11 → 2.5.15, @types/bun 1.4.0 → 1.4.2. Tier 2, minors of libraries this code only calls: @tabler/icons-react 3.46 → 3.48, @tanstack/react-query 5.101.4 → 5.104.1, tailwind-merge 3.6 → 3.7, zod 4.4.3 → 4.6.6, shadcn 4.17 → 4.21.1, knip 6.38 → 6.39, @types/node 26.2 → 26.6.4, @tauri-apps/cli 2.11.4 → 2.12.1. Why the lockfile is deduplicated by hand: `bun add` of a new version leaves the old one nested under every package that depended on it (`@modelcontextprotocol/sdk/hono: 4.13.7` beside the server's 4.13.13), and the two copies of hono then disagree on `Context` in the typecheck (`main.ts:1137`). Dependabot's lock has one copy; so does this one. Biome 2.5.15 reports the same two warnings as 2.5.11 on this tree and nothing new, so nothing is reformatted and it is not pinned back; the one thing it said was that `biome.json`'s `$schema` still named 2.5.11, so that line moves with it. Co-authored-by: LAF Agent <274876363+laf-agent@users.noreply.github.com>

…1.8, aimock 1.43 — shown live The tier with behaviour, from #207 and #206, each gated and then used in a browser: react and react-dom 19.2.8 → 19.3.0 (with @types/react, @types/react-dom), streamdown 2.5.0 → 2.7.0, @base-ui/react 1.7.0 → 1.8.0, @copilotkit/aimock 1.38.0 → 1.43.0. Streamdown 2.7.0 depends on remend 1.4.0 exactly and imports `INCOMPLETE_IMAGE_PLACEHOLDER` from it. The root `overrides` pinned remend to ^1.3.1 (2af08cb, so Korean emphasis closing against a particle is drawn as emphasis), and with that in force the lock keeps 1.3.1 for streamdown too — Dependabot's #207 has exactly that lock — and Vite refuses to start the app: `No matching export in ".../remend@1.3.1/..."`. The override moves to ^1.4.0, which still forbids what it was there to forbid. Streamdown 2.7 draws three zoom buttons on every diagram, so the renderer's word table gains `resetView`, `zoomIn` and `zoomOut` with their Korean — the table's type is the renderer's own list of words, so a word it gains is a type error here rather than an English label nobody noticed, which is what happened. Left out of this tier, each with its reason in the pull request: @happy-dom/global-registrator 20.14 (the app suite does not finish with it), @copilotkit/react-core and runtime 1.77 (needs a change in copilot.ts), better-auth 1.7 (sign-in source changes), eventsource 5 (would split the copy the MCP SDK requires from the one the entry preloads), @modelcontextprotocol/sdk 1.32 (walks same-origin redirects itself, past plugins/mcp.ts's refusal), prompt-area 0.7 (new peer package, IME rewrite), playwright 1.63 (the browser image's, #22). Co-authored-by: LAF Agent <274876363+laf-agent@users.noreply.github.com>

yulmucoffee · 2026-10-13T08:33:05Z

Closing: the updates here that could be shown safe landed in #214 (gate and a live run). Left out, each with its reason in #214's table: better-auth 1.7 and CopilotKit 1.77 need source changes, the MCP SDK 1.32 changes how redirects are followed, prompt-area 0.7 changes composition handling, and playwright follows the browser image (#22).

dependabot · 2026-10-13T08:33:09Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 11, 2026

codesolarlght Bot reviewed Oct 11, 2026

View reviewed changes

yulmucoffee mentioned this pull request Oct 13, 2026

chore(deps): the bumps from Dependabot's #207, #206 and #11 that are shown safe, in tiers #214

Merged

14 tasks done

yulmucoffee closed this Oct 13, 2026

dependabot Bot deleted the dependabot/bun/production-6a13d67b72 branch October 13, 2026 08:33

Navigation Menu

Repository navigation

chore(deps): Bump the production group across 1 directory with 23 updates - #207

chore(deps): Bump the production group across 1 directory with 23 updates#207
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-6a13d67b72

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

codesolarlght Bot left a comment

Uh oh!

yulmucoffee commented Oct 13, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 11, 2026

v2.9.1

v1.8.0

General changes

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Combobox

v1.8.0

General changes

Alert Dialog

Autocomplete

Avatar

Checkbox

Checkbox Group

Combobox

v1.77.0

Features

Fixes

Other Changes

v1.76.0

Features

Fixes

v1.75.2

Fixes

v1.75.1

Features

Fixes

1.77.0 - 2026-10-02

Features

Fixes

Other Changes

1.76.0 - 2026-09-30

Features

Fixes

1.75.2 - 2026-09-30

Fixes

1.75.1 - 2026-09-29

Features

Fixes

@​shadcn/react@​0.3.1

Patch Changes

0.3.1

Patch Changes

Release 3.48.0

18 new icons:

Release 3.47.0

18 new icons:

@​tanstack/react-query-devtools@​5.104.1

Patch Changes

@​tanstack/react-query-next-experimental@​5.104.1

Patch Changes

@​tanstack/react-query-persist-client@​5.104.1

Patch Changes

@​tanstack/react-query@​5.104.1

Patch Changes

@​tanstack/react-query-devtools@​5.104.0

Minor Changes

Patch Changes

@​tanstack/react-query-next-experimental@​5.104.0

Minor Changes

Patch Changes

@​tanstack/react-query-persist-client@​5.104.0

Minor Changes

5.104.1

Patch Changes

5.104.0

Minor Changes

Patch Changes

5.103.3

Patch Changes

5.103.2

Patch Changes

5.103.1

Patch Changes

5.103.0

Patch Changes

`@shadcn/react@0`.3.1

`@tanstack/react-query-devtools@5`.104.1

`@tanstack/react-query-next-experimental@5`.104.1

`@tanstack/react-query-persist-client@5`.104.1

`@tanstack/react-query@5`.104.1

`@tanstack/react-query-devtools@5`.104.0

`@tanstack/react-query-next-experimental@5`.104.0

`@tanstack/react-query-persist-client@5`.104.0

`@tanstack/react-router@1`.170.41

`@tanstack/react-router@1`.170.40

`@tanstack/react-router@1`.170.39

`better-auth`

`@better-auth/oauth-provider`

`@better-auth/drizzle-adapter`

`@better-auth/kysely-adapter`